Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

#326: commons-beanutils:1.9.4 -> commons-beanutils2:2.0.0 #327

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

#326: commons-beanutils:1.9.4 -> commons-beanutils2:2.0.0 #327

wants to merge 1 commit into from

Conversation

SoltauFintel
Copy link
Member

@SoltauFintel SoltauFintel commented Jul 25, 2024 •
edited
Loading

see #326

@SoltauFintel SoltauFintel requested a review from leonate July 25, 2024 15:31
@SoltauFintel SoltauFintel added this to the 3.1.0 milestone Jul 25, 2024
@SoltauFintel
Copy link
Member Author

SoltauFintel commented Jul 25, 2024 •
edited
Loading

It has to be mentioned that beanutils2 2.0.0 was not released by Apache. However, it looks like https://github.com/melloware/commons-beanutils2 has released it on MavenCentral.

@SoltauFintel SoltauFintel mentioned this pull request Jul 25, 2024
Open
leonate
leonate approved these changes Jul 27, 2024
View reviewed changes
Copy link
Member

@leonate leonate left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good job!
Are there any breaking changes between commons-beanutils and commons-beanutils2 that can impact us?

@SoltauFintel
Copy link
Member Author

@leonate : I don't know. Probably not. I can't say for sure.

@uek06
Copy link

uek06 commented Aug 27, 2024

Hi !
commons-beanutils is no longer maintained, and commons-beanutils2 seems like a dark fork where we have no guarantee that it will be udpated in the future.
Instead of relying on this kind of dependency, which can lead to future CVEs for instance, I think that we could delete this dependency and use full native Java reflection.
What do you think ?

@SoltauFintel
Copy link
Member Author

@uek06

I've had a quick look at it. I haven't found a commons-beanutils alternative. I don't have time for further research.

If you want to you can make a counterproposal as a new pull request. Object property access should be just as fast. The solution should allow DynaBean support to be added.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ydrozhdzhal ydrozhdzhal ydrozhdzhal approved these changes

@leonate leonate leonate approved these changes

Assignees
No one assigned
Labels
will-be-done-later
Projects
None yet
Milestone
3.1.0
Development

Successfully merging this pull request may close these issues.
4 participants
@SoltauFintel @uek06 @leonate @ydrozhdzhal